CVE-2026-98467

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR EL2 invalidation from MMU notifiers") introduced VNCR EL2 invalidation in both kvm nested s2 unmap() and kvm nested s2 wp().

However at the point of this being performed concurrent stage 2 teardown of a nested guest can cause kvm->arch.mmu.pgt to be set to NULL.

This happens in kvm flush shadow all() -> kvm arch flush shadow all() -> kvm free stage2 pgd() and is performed under the kvm->mmu lock.

Commit ec14c272408a ("KVM: arm64: nv: Unmap/flush shadow stage 2 page tables") introduced the teardown of the entire nested MMU range, which then invokes stage2 apply range() with resched=true:

mmu notifier invalidate range start() -> ... -> kvm mmu notifier invalidate range start() -> kvm mmu unmap gfn range() -> kvm unmap gfn range() -> kvm nested s2 unmap() -> kvm stage2 unmap range() -> unmap stage2 range() -> stage2 apply range()

This means that stage2 apply range() can drop the kvm->mmu lock and thus concurrent progress can be made in lockstep with kvm arch flush shadow all().

If kvm arch flush shadow all() advances ahead of stage2 apply range() and completes its operation it guarantees a NULL pointer deref.

Since kvm free stage2 pgd() is performed under the kvm->mmu lock this will either be observed NULL or not and serialised against kvm free stage2 pgd().

Resolve the issue by abstracting the invalidation to a new function, kvm invalidate vncr ipa all(), and check that the pgt is non-NULL before dereferencing it.